Operator: "Rule dc1 FIP pool 10.12.65.0-10.12.67.254". Validated before recording
-- inside 10.12.64.0/22, 767 addresses (identical in size to dc0's), no overlap
with the D-134 bands. Applied 1/1, read back.

Final state both DCs: check pass=24 fail=0 AND reserve planned=0 skipped=19
errors=0 -- converged and idempotent. ipranges 3 -> 29, both FIP pools reserved.
Machines 18 Ready + 2 Deployed unchanged throughout.

The ruling narrows dc1's deliberate unset list by exactly one pair; the VIP group
(R9: generated from the overlay) and the D-133-retired metal-internal stack stay
unset, now with harness guards so a future edit cannot widen it silently.

Two stale assertions RE-POINTED rather than deleted, per the standing rule against
going green by removing an assertion: dc-selector asserted dc1 unsets
FIP_POOL_START, and dc-plane-ipam T20 asserted dc1 refuses the pool. Both are
replaced with stronger checks -- the ruled value, the still-unset guards, and that
dc1 plans its OWN pool and never dc0's, which is what proves the tool reads a
per-DC value rather than a shared literal.

dc-selector 48 -> 51 checks. Gauntlet ALL GREEN (83).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf